Open Bug 1238832 (bmo_csp) Opened 9 years ago Updated 5 years ago

Implement Content Security Policy (CSP) for BMO

Categories

(bugzilla.mozilla.org :: General, enhancement)

Product:
bugzilla.mozilla.org
Component:
General
Version:
Production
Type:
enhancement
Priority:
Not set
Severity:
normal

Tracking

()

People

(Reporter: glob, Unassigned)

References

(Depends on 5 open bugs)

Details

(In reply to Byron Jones ‹:glob› from comment #0)
> It looks like there's quite a lot of inline scripts inside BMO, but it
> shouldn't (hopefully) be too agonizing to move them to external files.

yup - there's a lot of work there.  it's something that we're unlikely to start looking at until at least q2, but it's on our roadmap.  there's complexity which to an outside eye unfamiliar with bugzilla "looks easy enough", however in many instances this isn't the case (if it was easy, it would already be done).


however as far as i can tell disabling inline scripts with CSP also disables inline styles.  that's going to be a major problem and one that we'll have to figure out at a later stage.
> however as far as i can tell disabling inline scripts with CSP also disables inline styles.  that's going to be a major problem and one that we'll have to figure out at a later stage.

You can disable inline scripts while still allowing inline styles, eg:

Content-Security-Policy: default-src: https:; style-src https: 'unsafe-inline'
Alias: bmo_csp
Assignee: nobody → dylan
Depends on: 1441306
Type: defect → enhancement
Assignee: dylan → nobody
You need to log in before you can comment on or make changes to this bug.